SCA: security update for org.springframework.batch:spring-batch-core (GHSA-4ph4-q9r5-6wm6)

high Tenable Self-Hosted Container Security Plugin ID 410316

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- When configured to enable default typing, Jackson contained a deserialization vulnerability that could
lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization
gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the
previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's
Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write
access to the data store used by the JobRepository (where the data to be deserialized is stored). In order
to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being
deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when
enabling default typing. (CVE-2020-5411)

Plugin Details

Severity: High

ID: 410316

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-5411

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/24/2022

Vulnerability Publication Date: 6/11/2020

Reference Information

CVE: CVE-2020-5411

cwe: CWE-502

Detections

Analytics